[es] - ===== QSCypher Version 1.00 Text Starts Here =====

s00paman
superman
SUECCIA

Član broj: 4178
Poruke: 3
*.rg.m.bonet.se

ICQ: 858646

Profil

===== QSCypher Version 1.00 Text Starts Here =====

^{09.06.2002. u 11:02 - pre 266 meseci}

Hi guys. I need help decrypting ===== QSCypher Version 1.00 Text Starts Here =====. This is the only site that i found that has something about it and as i see you guys already cracked it.

I dont understand Serb so i was wondering if you could tell me in english how to decode it. Please if u help me i have a big reward.

Also if u have a program that i can use to decode cuz i cant program like that script says and i dont get anything from serb so please.

Odgovor na temu

StratOS
Slovenija

Član broj: 2234
Poruke: 989
*.dsl.siol.net

+1 Profil

Re: ===== QSCypher Version 1.00 Text Starts Here =====

^{10.06.2002. u 00:47 - pre 266 meseci}

Well i have seen some1 posed almost the same question in the other forums, please try to specify the problem is this a string u have to decode or some kind of enc/dec program. please specify program name and other info ...

Pozdrav StratOS
"Multitasking - ability to f##k up several things at once."
"It works better if you plug it in."
"As a rule, software systems do not work well until they have been used, and have failed repeatedly, in real applications."
"The one who is digging the hole for the other to fall in is allready in it."

Odgovor na temu

s00paman
superman
SUECCIA

Član broj: 4178
Poruke: 3
*.rg.m.bonet.se

ICQ: 858646

Profil

Re: ===== QSCypher Version 1.00 Text Starts Here =====

^{11.06.2002. u 00:16 - pre 266 meseci}

¨This is from a order.log file from a cgi script called Quickstore and this is how the full one looks likes.

===== QSCypher Version 1.00 Text Starts Here ===== 51AE738C43BC20DF31CE30CFF0AE518C73BC43DF20CE31CF30 619E43BB718C252F13011F485163E9A3AFEFA7B4FFF9BDB60A 2F4F4537000B4D113EA9F4E2BFF0F9AFA9D7951F3C5B4A3A05 190D3F2BA4F6E7ADB0A4EFFABDB716305743340259233E26A1 B6BAED94A1EDF8B4B2561D564D3A0B57245404A8BAB6E49AA6 ADD9B0B64418455E7A5617750652F8FA9AEB99AEEDFDA2BF52 1D2F7C735A1B7C0855B8D993FF80EEB0BD85AD5718213C515B 02162A5CB4D59AF187AE83A984B952587C7C667268342350B8 DC94F6C79E8CBA90B85E185F73627728696305EC8FC4A2ADBC 85B69CB1501F1F506D62267D711CACD284979E9DEF9495BD5C 1611572D522E727F19ECFC919A9C98FDD4C8FD0544411A7900 773F2641BEA4FBB89594F1DDC6FA45614C1B700C371E2245AC A1E8ABD5C9B1D9CBFB4B6F4515772C651B3852A9A3ECAEC6C0 B6D785F844622F36763E615B0C4BB9A6ACF386F6BFC4849267 633D3236106056090BE4E688F684F4B6C1C4BF666D333B3817 0A750819E0A6A6E389F6B3D384E2263961696A4558275A4BB2 F4F4B1E3D5B2C180A20321716078444C2E5545F2D0F5A5E695 EF81D0F453701B4F6A40493C1574E7D1FBB1EF81F6C18DB40A 1A345D6E455B7C2661E5C5F4A5EE8DB69CCDED5A54590D3E05 1F114C50F0C4FAB1E799AFDCE9E44957561830115F4C0C00BE A9AAE1A7DDC2B6DAE5455245580410470C5140EAE7C7B4F79D 86DBB0D64D5B55480D1E404C724FF9F3D4F4AADDD78BFEBB18 0B150C60746F5E764AEBB3F3E6ABD3D3CBCAB40C0A194C3D34 3E0E230486E3A3A6EFBEB9FED9B11E4A31432E207E271344A7 E7A7B4EAADAABE84F14C1A670D7A7030764216E9B0F3DE8099 A2BBC4D743166B026D793E71023FFDB5FECDC0AEA7A9C1976C 046F077F7C3A2B6F55979CEAC8CDEE89A68FD731443E6D4F6E 352F7A5683DCB788FDFC86A29AD425046F07607E2126755890 9CEAC8CFF982C8AAC62C076A473D3E70763B08C0F6DBDCD6B7 C295EA9F463365533C3230462901C3F39B8196EE92DBBACF2C 592633404D5A6774818E9BA8B5C2CFDCE9F603101D2A374451 ===== QSCypher Version 1.00 Text Ends Here =======

And as i undertsand its hex code. And i want to decode it but HOW?
In the other forum it says that they have done withe simple ASCII concert or something like that but i dont get serbien languag so please help me out.

When its decode it should look like a order with name adress what they order and ther credit card if lucky

Odgovor na temu

Gojko Vujovic
Amsterdam, NL

Administrator
Član broj: 1
Poruke: 13651

+165 Profil

Re: ===== QSCypher Version 1.00 Text Starts Here =====

^{11.06.2002. u 00:23 - pre 266 meseci}

Where were you english-speaking users when I tried to start a separated version of
this site, completely in english. I couldn't get more than 5-6 users for conversation on
security/programming subjects there.

Odgovor na temu

StratOS
Slovenija

Član broj: 2234
Poruke: 989
*.dsl.siol.net

+1 Profil

Re: ===== QSCypher Version 1.00 Text Starts Here =====

^{11.06.2002. u 00:44 - pre 266 meseci}

well vell, quikstore.cgi hacked

Citat:

When its decode it should look like a order with name adress what they order and ther credit card if lucky

Do u realy think this would be so easy, and u'll get this information as easy decrypted with ASCII/hex/hex dump conversion ?

I don't think so, perhaps u should be more specific where did u get that data if not kinda confidential, but i don't think this would be stored in non-secure web sites like plain encrypted text ? ( 100% not )

U'll get more results if u check the routine for enc/decryption in *.cgi present at that WEB site, but u are doing it on your own !!!

I would try to solve this with simple cryptographic approach, but i think it won't be enought the QSCypher got to tell u this is some kind of cryptographic method ...

Odgovor na temu

StratOS
Slovenija

Član broj: 2234
Poruke: 989
*.dsl.siol.net

+1 Profil

Re: ===== QSCypher Version 1.00 Text Starts Here =====

^{11.06.2002. u 00:59 - pre 266 meseci}

more info available at http://cgi.nessus.org/plugins/dump.php3?id=10712

Info on BugTraq:

QuikStore http://www.quikstore.com/
Platforms: Win32 / *Nix (Perl5)
Executable: quikstore.cgi
Exposed Order info: quikstore.cfg* (see note)
Status: Commercial ($175.00+ depending on options)
Number of exposed installs found: 3
PGP Option Available?: Unknown.

NOTE: This is, IMHO, one of the most dangerous of the lot, but
thankfully, one of the lowest number of discovered exposures. Although
the order information itself is secured behind an htaccess name/pwd
pair, the config file is not. The config file is world readable, and
contains the CLEAR TEXT of the ADMINS user id and password
- rendering the entire shopping cart vulnerable to an intruder.
QuikStore's "password protected Online Order Retrieval System" can be
wide open to the world. (Armed with the name and pwd, the web visitor
IS the administrator of the shopping cart, and can view orders, change
settings and order information - the works.)

other files available on WEB :
orders.txt
order.txt
import.txt
checks.txt
order_log
order.log
orders.log
orders_log
log_order
log_orders
temp_order
temp_orders
order_temp
orders_temp
quikstore.cfg
quikstore.cgi
order_log_v12.dat
also order_log.dat
web_store.cgi
storemgr.pw
admin.pw
cc.txt
ck.log
shopper.conf

more info ( in russian language ): http://www.krematoriy.com/mht/credit_card/credit_7.html

for encryption try to gather all files and *.cgi to check the encr/decry algorithm ... but i guess your time's wasted because of the password protected Online Order Retrieval System, check out the BugTraq section again :)

Odgovor na temu

s00paman
superman
SUECCIA

Član broj: 4178
Poruke: 3
*.rg.m.bonet.se

ICQ: 858646

Profil

Re: ===== QSCypher Version 1.00 Text Starts Here =====

^{11.06.2002. u 13:00 - pre 265 meseci}

But look u say its hard to decrypt it but this i found on your site.
http://www.elitesecurity.org/tema.php?TopicID=1466

And if im not correct dont it say how to decode it with that perl script or something like that.

And where i got is from a site with 107 order.log files and every one looks like that Encrypted stuff. See this is why im desperate to decrypt it.

But if i buy the Quickstore software. Wont it be bale to decode it?

Odgovor na temu

StratOS
Slovenija

Član broj: 2234
Poruke: 989
*.dsl.siol.net

+1 Profil

Re: ===== QSCypher Version 1.00 Text Starts Here =====

^{13.06.2002. u 09:06 - pre 265 meseci}

They thought it would be so easy ...
Check out my upper post again and u'll find everything about encryption/decryption method used for this transactions.

Odgovor na temu

byterage

Član broj: 5136
Poruke: 3
*.telenet-ops.be

Profil

Re: ===== QSCypher Version 1.00 Text Starts Here =====

^{31.08.2002. u 16:36 - pre 263 meseci}

===== QSCypher Version 1.00 Text Starts Here =====
51AE738C43BC20DF31CE30CFF0AE518C73BC43DF20CE31CF30 619E43BB718C252F13011F485163E9A3AFEFA7B4FFF9BDB60A 2F4F4537000B4D113EA9F4E2BFF0F9AFA9D7951F3C5B4A3A05 190D3F2BA4F6E7ADB0A4EFFABDB716305743340259233E26A1 B6BAED94A1EDF8B4B2561D564D3A0B57245404A8BAB6E49AA6 ADD9B0B64418455E7A5617750652F8FA9AEB99AEEDFDA2BF52 1D2F7C735A1B7C0855B8D993FF80EEB0BD85AD5718213C515B 02162A5CB4D59AF187AE83A984B952587C7C667268342350B8 DC94F6C79E8CBA90B85E185F73627728696305EC8FC4A2ADBC 85B69CB1501F1F506D62267D711CACD284979E9DEF9495BD5C 1611572D522E727F19ECFC919A9C98FDD4C8FD0544411A7900 773F2641BEA4FBB89594F1DDC6FA45614C1B700C371E2245AC A1E8ABD5C9B1D9CBFB4B6F4515772C651B3852A9A3ECAEC6C0 B6D785F844622F36763E615B0C4BB9A6ACF386F6BFC4849267 633D3236106056090BE4E688F684F4B6C1C4BF666D333B3817 0A750819E0A6A6E389F6B3D384E2263961696A4558275A4BB2 F4F4B1E3D5B2C180A20321716078444C2E5545F2D0F5A5E695 EF81D0F453701B4F6A40493C1574E7D1FBB1EF81F6C18DB40A 1A345D6E455B7C2661E5C5F4A5EE8DB69CCDED5A54590D3E05 1F114C50F0C4FAB1E799AFDCE9E44957561830115F4C0C00BE A9AAE1A7DDC2B6DAE5455245580410470C5140EAE7C7B4F79D 86DBB0D64D5B55480D1E404C724FF9F3D4F4AADDD78BFEBB18 0B150C60746F5E764AEBB3F3E6ABD3D3CBCAB40C0A194C3D34 3E0E230486E3A3A6EFBEB9FED9B11E4A31432E207E271344A7 E7A7B4EAADAABE84F14C1A670D7A7030764216E9B0F3DE8099 A2BBC4D743166B026D793E71023FFDB5FECDC0AEA7A9C1976C 046F077F7C3A2B6F55979CEAC8CDEE89A68FD731443E6D4F6E 352F7A5683DCB788FDFC86A29AD425046F07607E2126755890 9CEAC8CFF982C8AAC62C076A473D3E70763B08C0F6DBDCD6B7 C295EA9F463365533C3230462901C3F39B8196EE92DBBACF2C 592633404D5A6774818E9BA8B5C2CFDCE9F603101D2A374451
===== QSCypher Version 1.00 Text Ends Here =======

decrypted gives :

===
Date = 7-07-00
Customer Number = 3
Billing Name = Debbie Manning
Billing Address = 1260 Loch Drive
Billing City = Green Bay
Billing State = WI
Billing Postal Code = 54304
Billing Country = USA
Billing Phone Number = 920-429-9828
Billing Email Address = [email protected]
Card Type = Visa
Card Name = Debbie Manning
Card Number = 4222222222222
Card Expiration Date = 0601
Order Quantity = 9
Order Subtotal = 90.00 $
Quantity Discount = 0.00 $
Sales Tax = 4.50 $
Shipping Costs = 10.50 $
Order Grand Total = 105.00 $
User Host IP Address = 206.40.112.74

The Following Items Were Ordered:

Item No. = 1
Product = Product 1
Options = Red
Price = 10.00
Qty. = 9
Total Price = 90.00
===

grtz,

byterage
([email protected])
www.byterage.cjb.net

Odgovor na temu